Simple and efficient quantum key distribution with parametric down-conversion 
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We propose an efficient quantum key distribution protocol based on the photon-pair generation 
from parametric down-conversion (PDC). It uses the same experimental setup as the conventional 
protocol, but a refined data analysis enables detection of photon-number splitting attacks by utilizing 
information from a built-in decoy state. Assuming the use of practical detectors, we analyze the 
unconditional security of the new scheme and show that it improves the secure key generation rate 
by several orders of magnitude at long distances, using a high intensity PDC source. 

PACS numbers: 03.67.Dd, 03.67.-a, 42.65.Lm 



Quantum key distribution (QKD) is a promising appli- 
cation of quantum information, with which two distant 
legitimate users (the sender Alice and the receiver Bob) 
can share a common random bit string, known as a secret 
key, with negligible leak to an eavesdropper Eve. The 
first QKD protocol has been proposed by Bennett and 
Brassard in 1984, which is called BB84 [J. The original 
BB84 protocol proposes the use of an ideal single-photon 
source, and secure key distribution should be possible up 
to the distance at which Bob's photon detection rate and 
his dark counting rate are comparable. Since such an 
ideal single-photon source is not available today, weak 
coherent pulses (WCPs) from attenuated lasers are com- 
monly used as a photon source @, Hi IH Hi 0- The 
WCP has two imperfections, the multi-photon part and 
the vacuum part. The multi-photon part is vulnerable 
against photon- number splitting (PNS) attacks and 
one must reduce the energy of the WCP in order to re- 
duce the fraction of the multi-photon part. This leads to 
a very low key rate. The existence of the vacuum part 
simply leads to a reduction of Bob's photon detection 
rate, resulting in a shorter distance limit. Recent analy- 
ses [a, [HI show that the former problem can be avoided 
by randomly mixing pulses with different energies (decoy 
states) [ll| . But about half of the pulses are still in the 
vacuum state, and hence the distance limit falls short of 
the one with the ideal single-photon source. 

Another candidate of photon sources within reach of 
current technology is conditional generation of single 
photons based on parametric down-conversion (PDC) 
[12 ] . The state of the photons generated in two modes A 
and S by PDC can be written as [l3| 
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where \n) represents the state of n photons and // is the 
average photon-pair rate. If Alice measures the mode A 



FIG. 1: The experimental setup of QKD system with PDC. 
Alice and Bob choose the bases by polarization rotators 
(PR's). Bob detects the photons by two threshold detectors 
(Db's) after a polarizing beam splitter (PBS). The inset shows 
the photon number distributions of the triggered events p„ 
and the nontriggered events p„ , when fi = 0.3, j)a = 0.5 
and d A = 10" 6 . 



by an ideal photon-number-resolving detector with unit 
efficiency and selects the cases where just one photon has 
been detected, she would conditionally obtain an ideal 
single photon in mode S. But in practice, she must use a 
threshold (on/off) detector with nonunit efficiency, which 
cannot distinguish one from two or more photons. In 
this case, she selects the cases where the detection has 
occurred (triggered events). The good news is that the 
dark count rate of current detectors is very low, and we 
can still neglect the vacuum part of mode S for triggered 
events (see Fig. [TJ) . Hence this source achieves the same 
distance limit as the ideal source. On the other hand, 
the mode S contains multi-photons, which is the same 
drawback as the WCP. One must decrease fi and thereby 
reduce the rate of triggering to avoid PNS attacks, lead- 
ing to a severely low key rate. The remedies for this 
problem proposed so far are accompanied by introduc- 
tion of additional complexity to the experimental setup, 
such as the random amplitude modulation for the use 
of decoy states and/or replacing Alice's detector by de- 
tector arrays in space or in time domain to improve the 
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photon- number- resolving ability 14. |15|. 



In this letter, we propose a very simple solution. Noth- 
ing is added to the experimental setup of the PDC with 
a triggering detector. The crux of our new protocol is 
to run the BB84 protocol regardless of whether Alice's 
detector is triggered or not. By comparing the detection 
rates for the triggered events and the nontriggered events, 
we can detect the presence of PNS attacks. We assume 
that threshold detectors are used by Alice and Bob, and 
derive a formula for the unconditionally secure key rate. 
Borrowing the parameters in a recent experiment, our 
calculation shows that the key rate is improved by sev- 
eral orders of magnitude compared to the conventional 
security analysis. 

We first look at the property of Alice's source com- 
posed of PDC with Eq. ([I]) and a threshold detector Da 
with efficiency t/a and dark count rate dj±. Let 7„ be the 
probability of detection (triggering) at Da when n pho- 
tons are emitted in mode S. Since n photons are emitted 
also in mode A, we have 



7n = !-(!- d A )(l- m ) n . 



(3) 



Then n-photon emission events (at rate p n ) are divided 
into the events with triggering (at Pn ) and the events 
without triggering (at Pn ), where pn = Pnln and 
P« nt ^ = £>n(l — 7n)i whose distributions typically look like 

Fig.ru 

Alice changes the polarization of the pulse in mode 
S according to the BB84 protocol and sends it to Bob. 
Bob measures this signal by a polarization rotator and a 
polarizing beam splitter followed by two threshold detec- 
tors, as in Fig.[TJ We say the signal is 'detected' by Bob if 
at least one of the detectors clicks. When both detectors 
click, Bob assumes his outcome to be a random bit value. 
Let Q n be the rate of events where Alice emits n pho- 
tons in mode S and Bob detects the signal. These events 
are also divided into two groups, the events accompa- 
nied by Alice's triggering (at rate Qn ) and the rest (at 
Q„ nt) ), where Q%> = Q n j n and Qn^ = Q n (l - 7n)- Be- 
hind these relations lies the fact that the state of PDC 
in Eq. ([1]) becomes a direct product once we condition 
on the photon number n in mode S. Hence there should 
be no correlations between the triggering at Da and any 
event occurring in mode S. This fact also ensures that the 
quantum bit error rate (QBER) e„ when Alice emits n 
photons in mode S should be the same whether or not the 
triggering occurs at Da- Therefore, the overall detection 
rate Q^ and the QBER E^ with triggering, and the 
overall detection rate Q (nt) and the QBER fi^ without 



triggering are expressed by 
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These four quantities are observed in the actual protocol, 
while there is no way to measure directly the contribu- 
tions from each photon number, except for eo, which is 
always 1/2. 

We discuss the security of our protocol by Gottesman- 
Lo-Liitkenhaus-Preskill formula [161 Il7| , which is written 
as follows for the key rate R^' with triggering: 

R (t) = q{-Q (t) f{E { ^)H 2 {E^) 

+Q$ ) +Q? ) [l-H 2 (e 1 )}}. (6) 

The formula has recently been proved [r| to be valid 
even if Bob's detection is made by threshold detectors 
as in Fig. [T] as long as the two detectors have the same 
efficiency. Here q(— 1/2) is the protocol efficiency, f(E) 
is the error correction efficiency, and H 2 (E) is the binary 
entropy function. Since Qq \ Q*i \ and e\ are not ex- 
actly determined in the actual protocol, we must adopt 
the worst value of Ry> in the possible range of these pa- 
rameters. 

In the conventional protocol, we only observe Q^ and 
£?W. In this case, we rely on the obvious inequality 
Qn) < Pn t° obtain an upper bound on the multi- 
photon contribution Q^ um = Y^^Q^ ■ This bound 

is meaningful only when Q (t) > p^ lti = X^L 2 P» ■ 
Since the scaling to fi and the channel transmission rj c 
is ~ 0(t] c [jl) and p™ lti ~ 0([i 2 ), we have to choose 
fx ~ 0(r) c ) and hence R™ ~ 0(rj^) at best, which means 
a rapid decrease of the key rate against the distance [see 
Fig. [1(f) below]. 

Now we will show that observation of nontriggered 
events, Q( nt ) and fiM, leads to a significant improve- 
ment of the key rate. The crucial relation is 



)(t) _ Q(nt) 



where r n = j n / (1 — 7„) = p^/Pri"^- Eve cannot alter r n 
since it is determined by Alice's parameters 77A and 
From Eq. we see 



(7) 



< r < 71 < r 2 < r 3 
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By comparing r = Q^/Q^ with r„'s, we have a clue 
about the distribution Qn over the photon number. The 
mechanism can be explained in two different ways. If 
we assume Alice's measurement by Da occurs earlier, 
then it looks as if she randomly switches between two 



distributions, {pn"*} and {pn ll> }- This is rather similar 



(nth 
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to the idea of one-decoy-state QKD Q. Comparing r 
and r n = p$ /pn^ gives a clue about the PNS attacks, 
namely, r should be close to r\ in the normal opera- 
tion, but it will approach r 2 if Eve exploits the multi- 
photon events. If we assume Alice's measurement occurs 
after Bob's detection, we notice that the photon num- 
ber distribution at mode A conditioned on Bob's detec- 
tion is proportional to Q n . Hence Alice physically pos- 
sesses the distribution about which she wants to learn, 
and she makes a measurement by Da- The averaged 
rate Q (t) /(Q (nt) + <3 (t) ) should then be compared with 
7„, which is equivalent to the comparison between r and 

r n = 7n/(l - In)- 

The remaining question is whether such a clue is 
enough to improve the key rate significantly. In the decoy 
state methods, we can tailor the number and the ampli- 
tudes of decoy states at will, but here we have no such 
freedom except for the strength \i of PDC. This is an- 
swered by conducting a quantitative analysis as follows. 
From Eqs. and ©, we have r 2 Q { n t} < Qn ] for n > 2. 
Applying Eq. ® leads to r 2 (Q( nt ) - Q nt) - Q[ at) ) < 
— Qq ' — Qi ^ — rQ( nt ^ — i — i i ■ j j 

•>(nt) 



- roQ^ - ri Q[ nt) . We thus 



obtain the minimum value of as a function of the 

only remaining unknown parameter x = Qq /Q^ nt ^: 



<3i nt) > r 2 -r-(r 2 - r )x = 



r 2 - n 
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From Eqs. ([5]) and ([7]) with eo = 1/2, an upper bound on 
ei is given by 



ei < [QV>EF> - Q«e ]/Q( 1 
2 r £?( t ) -r x 
* =et{x) - 
In a similar way, we have another bound 
2£'(» t ) _ ~ 



(t) 



ei < 



2£(z) 



e n t(x). 



Combining the two bounds, we have 

ex < e(x) = rnin{e t (x),e n t(a;)}. 



(10) 



(11) 
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Consequently, in the limit of large block size with which 
the estimation errors are negligible, the key rate from the 
triggered events is given by 



R®/q 
+Q (nt) 



= -Q^f{E^)H 2 {E^) 
min{r x + rif(x)[l - H 2 (e(x))}}, 



(13) 



where the minimum is taken over the range < x < 
min{2i?( t )(r/ro), 2E^}. This minimization should be 
numerically calculated in general, and we give examples 
later. Before that, we here discuss the scaling of the key 
rate Ry) against the channel transmission ry c . Up to the 



distance at which the influence of the dark countings of 
Bob's detectors becomes substantial, the error rates 
and E^V are almost independent of r/ c . The detection 
rates Q^' and Q( nt ) are both proportional to r] c , and their 
ratio r is also independent of rj c . Then, the functions 
£(x), et(x), and e n t(x) are independent of r) c , and hence 
the key rate in Eq. JT3J) scales as - 0{r) c ). The PDC 
strength n only affects the constant factor here, and its 
optimum value is independent of rj c . This is a significant 
improvement over the rate of the conventional protocol, 
- 0(r? c 2 ). 

When the distance is not so large, we may produce 
a secret key also from the nontriggered events. In this 
case, it is more efficient when the error reconciliation is 
separately applied to the triggered events and to the non- 
triggered events, but the privacy amplification is applied 
together, namely, after the two reconciled keys are con- 
catenated. The key rate i?( both ) in this strategy is given 
by 



#(both)/ 5 = -Q(Vf( E M)H 2 {E^) 



-Q {nt) f(E (nt, )H 2 (E (nt >) + Q 
-(l + ri )ttx)[l-H 2 (e(x))]}. 



)(nt) . 



i{(l + r )x 



(14) 



The final key rate is thus given by R — 
max{i?( both \ 

Next, we assume a channel model and show numerical 
examples of the key rate R as a function of the distance /. 
Let 77c = 10~ q/ / 10 be the channel transmission, t]b be the 
quantum efficiency of Bob's detectors, and rj = r) c i]B. The 
background rate pd of each detector is the combination 
of the rates of the dark count and the stray light, which 
are assumed to happen independently. For simplicity, we 
assume that both detectors have the same background 
rate. Qn is then given by 



)(t) 



M t} - l-(l-r?ni-p d ) s 



(15) 



and is calculated by taking summation. Let ed be 
the probability that a photon sent from Alice hits the 
erroneous detector, which is independent of the length of 
the quantum channel. Then we have, after some calcula- 
tion, 

2QWe„/pW = l-(l-7 7 )"(l-p d ) 2 

-(1 -p d )[(l ~ Ve d ) n - (1 - 77 + ryea)™], (16) 

and E^> is calculated by taking summation. Q^> and 
are calculated similarly. 
The values of the parameters are chosen as follows. 
Alice may use a non-degenerate PDC and obtain vis- 
ible and telecom-wavelength photons in mode A and 
S, respectively Therefore, wc assume a typical silicon 
avalanche photodiode for Da, which has <1a = 10~ 6 and 
(a) t]a = 0.5. We also show the case with (b) tja = 0.1 
to see the dependence on tja- The remaining parameters 
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FIG. 2: Achievable key rates for different implementations 
of BB84. The calculations are done in the case of (a) the 
efficient PDC protocol with r/A = 0.5 and cLa = 10 -6 , (b) 
the efficient PDC protocol with tja = 0.1 and cIa = 10~ 6 , 
(c) ideal single-photon source, (d) WCP with infinite number 
of decoy states, (e) WCP with one decoy state, and (f) the 
conventional PDC protocol with t/a — 1 and d,A = 0. 



are borrowed from the experiment by Gobby et al. [2|, 
which are a = 0.21 [dB/km],p d = 8.5 xlO" 7 , ^ = 0.045, 
e d = 3.3 [%], and /(£ (t) ) = f(E^) = 1.22. For each 
distance I, we have chosen the optimum value /i opt for /i 
so that the key rate is highest, and the result is shown in 
Fig.[2]as curves (a) and (b). The step at ~ 130 km, more 
pronounced on curve (b), appears since the nontriggered 
events cease to contribute to the final key at this dis- 
tance. Beyond this distance, the difference in r/A causes 
a slightly low key generation rate for (b). We have also 
shown [curve (f)] the key rate for the conventional anal- 
ysis with cIa — and rj A = 1. The remaining parameters 
are chosen to be the same. In comparison to this key rate 
with 0(rfc) dependence, the key rates in our new proto- 
col scale as 0(?7 C ), and the improvement reaches several 
orders of magnitude as the distance gets larger. Let us 
emphasize again that the two protocols use exactly the 
same experimental setup. 

For comparison, we included key rates for schemes us- 
ing WCP with decoy states [curves (d) and (e)] i- At 
shorter distances, the difference comes from that of the 
optimal mean photon number. For example, fi op t of (d) 
is 0.48 while that of (a) is 0.19. This may be caused 
by the higher multi-photon rate of PDC, whose photon 
number distribution p n is thermal. However, the present 
scheme has a positive key gain up to almost the same 
distances as with an ideal photon source [curve (c)] . The 
fact that no additional elements are needed in the PDC 
setup to beat PNS attacks makes it a viable candidate for 
the practical QKD. Recently Ma et al. [l9| have shown 
that the achievable distance of WCP is further improved 
by two-way classical communication and post-processing. 



This interesting scheme also improves that of our scheme. 

Finally, it is worth to discuss the feasibility of the 
present scheme. As shown in Ref. , high photon-pair 
generation from PDC (/i = 0.9) using PPLN devices is 
possible in current technologies. The repetition rate of 
our scheme will be limited by that of Da, but it can be 
improved by a high-repetition photon detection scheme 
\2l\ . Unlike WCP schemes, the achievable distances with 
the single-photon source and the PDC source depend on 
the coupling efficiency between the source and the single- 
mode fiber. In the case of PDC from PPLN waveguide, 
we can estimate the coupling efficiency of more than 80 
% in the current experiment [22], which still leads to a 
longer achievable distance than WCP schemes. The PDC 
source and the single-photon source also suffer from other 
losses in mode S such as ones at the polarization rotator, 
so further reduction of the losses is an important subject 
in the future experimental studies. 

In conclusion, we have proposed an efficient QKD pro- 
tocol with PDC, which utilizes the events discarded in 
the conventional PDC protocol to derive tighter bounds 
on the rate and the QBER of the single-photon part. The 
only difference between the present and the conventional 
protocol is the classical data processing. We found that 
the key rate is significantly improved in the new protocol. 
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